Dev Stack Source

Answer : PFX files are PKCS#12 Personal Information Exchange Syntax Standard bundles. They can include arbitrary number of private keys with accompanying X.509 certificates and a certificate authority chain (set certificates). If you want to extract client certificates, you can use OpenSSL's PKCS12 tool. openssl pkcs12 -in input.pfx -out mycerts.crt -nokeys -clcerts The command above will output certificate(s) in PEM format. The ".crt" file extension is handled by both macOS and Window. You mention ".cer" extension in the question which is conventionally used for the DER encoded files. A binary encoding. Try the ".crt" file first and if it's not accepted, easy to convert from PEM to DER: openssl x509 -inform pem -in mycerts.crt -outform der -out mycerts.cer the simple way I believe is to import it then export it, using the certificate manager in Windows Management Console. If you're working in PowerShell you can use something like the follo...

Answer : Another perspective for doing it on Linux... here is how to do it so that the resulting single file contains the decrypted private key so that something like HAProxy can use it without prompting you for passphrase. openssl pkcs12 -in file.pfx -out file.pem -nodes Then you can configure HAProxy to use the file.pem file. This is an EDIT from previous version where I had these multiple steps until I realized the -nodes option just simply bypasses the private key encryption. But I'm leaving it here as it may just help with teaching. openssl pkcs12 -in file.pfx -out file.nokey.pem -nokeys openssl pkcs12 -in file.pfx -out file.withkey.pem openssl rsa -in file.withkey.pem -out file.key cat file.nokey.pem file.key > file.combo.pem The 1st step prompts you for the password to open the PFX. The 2nd step prompts you for that plus also to make up a passphrase for the key. The 3rd step prompts you to enter the passphrase you just made up to store decrypted. The 4th puts it all t...